The regex to decode a number in fpformat is susceptible tocatastrophic backtracking.This is a potential DOS vector if a server is using fpformat onuntrusted number strings.Replace it with an equivalent non-vulnerable regex.The match behavior of the new regex is slightly different.This difference is addressed with a follow-up check.

Use a simplified regex.Capture the integer part of the number in one group,then strip off leading 0's.